CVE-2026-71264 WLED Unauthenticated Configuration Disclosure via /json/cfg and Global Settings-PIN Lock State
Unauthenticated attackers can access WLED device configuration details via the /json/cfg endpoint, exposing network and hardware settings.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-71264?
CVE-2026-71264 is a high-severity vulnerability in Aircoookie WLED, published on 5 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
WLED's GET /json/cfg endpoint (registered in wled00/wled_server.cpp) calls serveJson with no settings-PIN check, unlike the /edit endpoint which explicitly checks correctPIN, disclosing the device's general configuration (network, hardware, LED setup) to any unauthenticated client on the network.
Weakness: CWE-862
Which versions are affected by CVE-2026-71264?
How do I fix CVE-2026-71264?
No fix has been published for CVE-2026-71264 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-71264 being exploited?
There is no known exploitation of CVE-2026-71264 in the wild and no public exploit code.
Sources
Also known as GHSA-822p-39fj-m835.